@@ -249,11 +249,10 @@ async fn read_workspace(
     go_mod: Option<&str>,
     go_work: &str,
 ) -> (Option<Vec<MainModule>>, Vec<String>) {
-    let mut mains = Some(Vec::new());
+    let mut mains = Vec::new();
     let mut files = vec![GO_WORK_SUM.to_string()];
     for dir in go_mod_edit::parse_use_dirs(go_work) {
         let Some(dir) = member_dir(&dir) else {
-            mains = None;
             continue;
         };
         let text = if dir.is_empty() {
@@ -265,17 +264,15 @@ async fn read_workspace(
                 None => None,
             }
         };
-        match (text, mains.as_mut()) {
-            (Some(text), Some(mains)) => mains.push(MainModule::new(&text)),
-            (Some(_), None) => {}
-            (None, _) => mains = None,
+        if let Some(text) = text {
+            mains.push(MainModule::new(&text));
         }
         let sum = member_file(&dir, GO_SUM);
         if !files.contains(&sum) {
             files.push(sum);
         }
     }
-    (mains, files)
+    (Some(mains), files)
 }
 
 /// Normalize a go.mod-grammar file (BOM, simple string literals) and check
@@ -357,7 +354,7 @@ fn extract_file(
                     SumPin::Zip(_) => graph.workspace,
                     SumPin::Unpinned => false,
                 };
-                if check {
+                let workspace_higher = if check {
                     let req = required.get(&entry.module).map(String::as_str);
                     // `replaced_purl` resolved one of the two.
                     let version = entry.version.as_deref().or(req).unwrap_or_default();
@@ -375,9 +372,23 @@ fn extract_file(
                         );
                         continue;
                     }
-                }
+                    // In workspace mode, also check go.work.sum for higher versions.
+                    // Those lines outlive the requirement that raised the module, so
+                    // they don't prove selection: emit the ref but don't attest it.
+                    if graph.workspace {
+                        let workspace_zips = sums.workspace_zip_versions(&entry.module);
+                        workspace_zips
+                            .iter()
+                            .any(|v| go_semver_cmp(v, version) == Ordering::Greater)
+                    } else {
+                        false
+                    }
+                } else {
+                    false
+                };
                 let (integrity, integrity_required) = match pin {
-                    SumPin::Zip(h1) => (Some(LockIntegrity::GoH1(h1)), true),
+                    SumPin::Zip(h1) if !workspace_higher => (Some(LockIntegrity::GoH1(h1)), true),
+                    SumPin::Zip(_) => (None, true),
                     SumPin::GoModOnly => (None, graph.workspace),
                     SumPin::Unpinned => (None, true),
                 };
@@ -536,6 +547,9 @@ struct SumPins {
     unparseable: bool,
     /// Every module's zip-line versions (the build-list evidence).
     zip_versions: HashMap<String, Vec<String>>,
+    /// go.work.sum zip-line versions: used to detect inert workspace
+    /// replaces but not as selection proof.
+    workspace_zip_versions: HashMap<String, Vec<String>>,
 }
 
 /// What the sum files pin for one Socket `module@version`.
@@ -553,7 +567,7 @@ impl SumPins {
         let mut pins = SumPins::default();
         for file in files {
             if let Some(text) = ctx.read_text(file, out).await {
-                pins.add(&text, file != GO_WORK_SUM);
+                pins.add(&text, file != GO_WORK_SUM, file == GO_WORK_SUM);
             }
         }
         pins
@@ -562,7 +576,9 @@ impl SumPins {
     /// `selects`: whether the file's zip lines show what the build selects.
     /// go only ever appends to `go.work.sum`, so its lines outlive the
     /// requirement that raised a module.
-    fn add(&mut self, text: &str, selects: bool) {
+    /// `workspace_sum`: whether this is go.work.sum (used to detect inert
+    /// workspace replaces but not as selection proof).
+    fn add(&mut self, text: &str, selects: bool, workspace_sum: bool) {
         // go rejects a whole go.sum with any non-blank line of other than
         // three tokens (only `go mod tidy` skips it).
         if text
@@ -573,11 +589,19 @@ impl SumPins {
             return;
         }
         for line in go_sum_lines(text) {
-            if !line.go_mod && selects {
-                self.zip_versions
-                    .entry(line.module.to_string())
-                    .or_default()
-                    .push(line.version.to_string());
+            if !line.go_mod {
+                if selects {
+                    self.zip_versions
+                        .entry(line.module.to_string())
+                        .or_default()
+                        .push(line.version.to_string());
+                }
+                if workspace_sum {
+                    self.workspace_zip_versions
+                        .entry(line.module.to_string())
+                        .or_default()
+                        .push(line.version.to_string());
+                }
             }
             // go ignores hashes of algorithms it does not know.
             if !line.module.starts_with(HOSTED_GO_MODULE_PREFIX) || !line.hash.starts_with("h1:") {
@@ -624,6 +648,13 @@ impl SumPins {
             .map(|v| v.iter().map(String::as_str).collect())
             .unwrap_or_default()
     }
+
+    fn workspace_zip_versions(&self, module: &str) -> Vec<&str> {
+        self.workspace_zip_versions
+            .get(module)
+            .map(|v| v.iter().map(String::as_str).collect())
+            .unwrap_or_default()
+    }
 }
 
 /// Root-relative directory of a `go.work` `use` member (`""` for the root